fix(security): honour Pods field restrictions (audit M4)

PodsFieldSource maps hidden, read_only, admin_only and
restrict_role/-capability like Pods' own view: hidden -> new status
HIDDEN, read_only -> READONLY, restricted and not permitted -> READONLY
with read_only_restricted, else HIDDEN. HIDDEN fields are not described,
read out, queried or written (they look unknown) but stay in the schema
for the media usage search; write() re-checks before Pods' save().
Required-but-restricted fields no longer block a create. Pods is not
active on DDEV: covered by unit tests with a field-option fixture.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7

src/Integrations/WordPress/Content/PostPresenter.php

@@ -180,6 +180,7 @@ class PostPresenter
     }
 
     /**
+     * Fields hidden for the current user (FieldDefinition::HIDDEN, e.g. restricted Pods fields),
      * Pods password fields and readonly protected meta (WordPress' own "_"-prefixed
      * internal keys) are never read out via lit-content-get/-query: neither belongs in
      * front of the model, and both are one plugin registration away from leaking secrets
@@ -189,7 +190,7 @@ class PostPresenter
      */
     public static function isHiddenField(FieldDefinition $field): bool
     {
-        if ($field->type === 'password') {
+        if ($field->type === 'password' || $field->status === FieldDefinition::HIDDEN) {
             return true;
         }